Questions tagged [enumeration]

Pre-attack is a phase where an attacker attempts to discover information about their target. This can involve network reconnaissance, operational intelligence, historical information, etc.

Filter by
Sorted by
Tagged with
1 vote
0 answers
31 views

How to get the list of computers a user can RDP into using BloodHound?

Using bloodhound I would like to find the list of all computers a user I.e "domain\ajohn" can RDP into. I looked at: match p=(g:Group)-[:CanRDP]->(c:Computer) where g.objectid ENDS WITH '-...
user avatar
  • 11
0 votes
1 answer
42 views

DNS Enumeration by IP Address

I know all baseline steps to do DNS enumeration over a domain. But my questions is: how can I enumerate a server when I do not know which domain it is managing and I only have its IP address? My ...
user avatar
3 votes
2 answers
70 views

Mail gateway allowing telnet connections

Our organization is currently being tested by a IT security firm who have stated that while our internet facing mail gateway is not an open relay, they can connect to it on port 25 using telnet and ...
user avatar
0 votes
0 answers
212 views

Is it possible to prevent Kerbrute from unauthenticated user enumation Active Directory?

Currently looking for a way to prevent unauthenticated user enumeration on a Domain Controller. This is a security precaution I'd like to implement, next to the existing measures taken prevent ...
user avatar
0 votes
1 answer
121 views

Verifying IP addresses during pentest

When conducting an external pentest and the scope is broad covering everything owned by the client, how would you verify if the enumerated IP addresses belong to a client? Running 'nslookup' on the IP ...
user avatar
  • 155
0 votes
1 answer
114 views

How to enumerate PGP keyring e-mails related to a specific ccTLD

I would like to enumerate all possible PGP e-mails related to North Korean top-level domain .kp Few years ago I would have used theHarvester but I recently discovered that this useful tool doesn't ...
user avatar
2 votes
1 answer
136 views

Rate Limit DNS Subdomain Requests

I work at a company that provides a SaaS program for other organizations, and each subscribed organization receives their own subdomain of their choosing - generally they choose the organization name. ...
user avatar
  • 123
0 votes
1 answer
228 views

SNMP Enumeration

I'm scanning a machine that has the UDP port 161 open and I'm not able to run snmpwalk against it as I'm returned with the error: Timeout: No Response from <IP> I tried to run the onesixtyone ...
user avatar
  • 1
1 vote
1 answer
126 views

Directories enumeration by errors. CVSS3.1 and remediation

Let's consider this scenario. If I browse to https://www.example.com/existentdirectory the web application shows this error "directory listing is denied". If I browse to https://www.example....
user avatar
  • 487
0 votes
1 answer
1k views

AutoRecon is taking too long to complete

AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing ...
user avatar
  • 347
1 vote
1 answer
905 views

using Uuid for security

I read that uuid does not bring any security advantages But I can't find why It doesn't bring a little bit of extra security in the scenario below ?: Consider that right now the session id is ...
user avatar
  • 13
0 votes
0 answers
101 views

Username enumeration with multiple inputs

Consider the case of username enumeration, where a hacker is able to determine a username based on UI feedback being different from a successful entry vs a failed entry. For example, a website's ...
user avatar
1 vote
1 answer
2k views

How to prevent Directory Enumeration Attacks (DirB or Directory Buster)

I am dabbling in pen testing (OWASP Juice Shop) and I realized many web application attacks start from enumeration where the attacker uses DirB to find vulnerable Web Objects or Directories to attack ...
user avatar
1 vote
1 answer
583 views

It is possible to enumerate/discover IIS applications from outside?

I wonder if it is possible that someone, from the Internet, could be able to discover services provided via IIS by knowing only the IP address. If yes, how? And how can I protect my IIS from this ...
user avatar
  • 21
2 votes
0 answers
106 views

How do scanners know which apache2 modules are installed?

My machines routinely get scanned by Qualys and other scanners that report my supported and patched version of php as wildly out of date (even though they're patched quarterly, I get flagged on ...
user avatar
2 votes
1 answer
73 views

Periods in Common Platform Enumeration WFN (NIST Interagency Report 7695 )

I’m looking at NIST Interagency Report 7695 and the grammar described in 5.3.2 seems to say that all . need to be preceded by a \, but this doesn’t seem to be followed in the CPE dictionary. Am I ...
user avatar
  • 31
0 votes
1 answer
162 views

Enumerating hosts running Elastic Stack

I am currently working on a project where I need to find a host running a SIEM solution. From my research I am fairly confident that the host is running Elastic Stack, probably within another solution ...
user avatar
  • 23
2 votes
1 answer
980 views

List of common website endings/pages for enumeration? [closed]

I am currently building a Python-based OSINT tool that allows a user to crawl a supplied domain for pages using traditional scraping/spider methods, but I also want to have the option to 'brute force' ...
user avatar
0 votes
1 answer
121 views

How to determine all public IP adresses from within an organization?

I can determine a single public IP address from within the organization (using NAT) by sending a HTTP request to one of the publically available services: curl ipinfo.io/ip However, if my request ...
user avatar
  • 1,087
2 votes
1 answer
7k views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
user avatar
  • 141
10 votes
2 answers
977 views

How do exploit kits enumerate or fingerprint their targets?

My current understanding is that an exploit kit will fingerprint (gather information on) a system, check those details against a database of vulnerabilities and then attempt to use the relevant ...
user avatar
  • 1,459
3 votes
1 answer
120 views

To what extent should we defend against leaked credentials being tested against our system?

We see these kinds of attempts with some frequency. Normally a leak has happened from some other 3rd party, and an attacker has a big list of known account + password combinations that they can try ...
user avatar
0 votes
1 answer
783 views

how to do internal subdomain enumerations in corp network?

I need to figure out a good way to do internal subdomain enumerations in corp network? My goal is to find the list of internal subdomains in my organizations. I tried https://github.com/TheRook/...
user avatar
  • 41
4 votes
1 answer
2k views

Can someone explain me the DNSSEC NSEC3 output?

I'm trying to understand how NSEC and NSEC3 records work in DNSSEC. When I query for an non-existent domain with supports NSEC3, I get the following output $ dig +dnssec NSEC3 gggg.icann.org. | grep -...
user avatar
  • 41
3 votes
2 answers
738 views

What is the key to detecting all IoT devices in your organization? [closed]

In recent news, IoT devices are a target of hackers -- specifically botnet herders. The first step to securing your organization and its users is to detect all IoT devices that are functional on your ...
user avatar
  • 1,356
1 vote
2 answers
6k views

Discover Hidden WiFi SSID

How to discover hidden SSIDs ? I know there are tool like WiGLE WiFi (Mobile) which can identify hidden SSID. How those tools are exactly working. How it is discovering hidden SSID WiFi beacons ?
user avatar
  • 1,257
3 votes
2 answers
928 views

Fingerprinting servers behind firewall

I am currently testing some servers that are present behind a firewall. During the scanning I am unable identify which ports are open except port 80. I have used various switches for Nmap only -Pn ...
user avatar
  • 271
0 votes
0 answers
3k views

How to enumerate DCE services on open port 135?

I did a vulnerability scan on a machine and found a DCE Services Enumeration vulnerability. This is described as: Distributed Computing Environment (DCE) services running on the remote host can be ...
user avatar
  • 235
1 vote
2 answers
2k views

How can you enumerate an internal network with minimal outside knowledge?

The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet. Right out of the gate you know your IP, gateway, ...
user avatar
  • 728
3 votes
1 answer
171 views

How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?

It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
user avatar
  • 652
6 votes
1 answer
1k views

Are these encrypted URL values safe or could they be guessed?

One of our suppliers had a weakness on the secure section of his webpage. By changing ID's in the URL, we could see data that did not belong to us. For example: https://supplier.org/showItem.do?...
user avatar
  • 3,898
4 votes
1 answer
9k views

Beyond Nmap: Investigating open TCP ports bound to unknown services

I have an uninvited guest using my private WLAN. At first I thought it was probably just a tech-savvy neighbour in need of Internet access, in which case; it wouldn't really bother me. However, I've ...
user avatar
  • 1,639
8 votes
1 answer
489 views

Strange responses from an unfamiliar HTTP server

I noticed an unfamiliar device when scanning my local wireless network. It had two open (listening?) TCP ports; TCP/80 (http?) & TCP/443 (https?). In an effort to identify the unfamiliar device;...
user avatar
  • 1,639
8 votes
6 answers
3k views

Should I use a cryptograpically secure random number generator when I generate IDs?

It is common to generate random identifiers to expose through an API instead of using a simple auto incrementing primary key. The reasons are many: Prevents easy enumeration. Does not give away order ...
user avatar
  • 64.2k
7 votes
1 answer
5k views

Informative error messages in password reset functionality? [duplicate]

When I am implementing password reset functionality I usually do not include informative messages about whether a user was found, because I have always believed that it can lead to user name ...
user avatar
  • 8,145
1 vote
3 answers
596 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
user avatar
0 votes
1 answer
84 views

Subdomain Bruteforcing when every request gets resolved?

Is it possible for an attacker to get a list of the subdomains configured for my server, if every subdomain request gets resolved? In the case of a subdomain that doesn't exist, the server simply ...
user avatar
  • 41
2 votes
1 answer
584 views

NMAP's explicitely closed ports

I'm working on a challenge and I notice this odd output for a full port scan? abc@desktop:~$ nmap -T5 -p- -sV x.x.x.x -PN Interesting ports on x.x.x.x: Not shown: 65533 filtered ports PORT ...
user avatar
  • 1,407
1 vote
1 answer
418 views

Some questions about port-scans

I have two questions and it seems like this website is the perfect place to ask them. I read a post earlier concerning port scans and one of the answers stated something along the lines of: "There is ...
user avatar
8 votes
3 answers
15k views

enumeration and MS DCERPC

Enumeration, enumeration, and even more enumeration is the generic pentesting mantra, but enumeration is worthless if you can't read the results. I came across the Windows RPC service, where ...
user avatar
1 vote
0 answers
374 views

How can a remote attacker find a user UID via Samba?

Is there a way to remotely retrieve the UID of a user via a Samba share? I can get the user list with: rpcclient -W 'WORKGROUP' -c querydispinfo -U''%'' '192.168.21.129' 2>&1 index: 0xa RID: ...
user avatar
2 votes
1 answer
162 views

Avoid brute-force enumeration of customers in a SaaS application

I'm involved in the development of a SaaS application. We host the application for different customers. A customer is a company. Each customer gets access to their hosted instance of the application ...
user avatar
  • 405
4 votes
3 answers
39k views

Scan all possible files on server (Brute force Filenames)

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to. So it would try something like: example.com/a, example.com/b,...
user avatar
10 votes
2 answers
2k views

User Enumeration Vulnerability while creating Google account

When we create a Google account, Google tells us whether an account with specified username exists or not. Doesn't that lead to user enumeration? Why not let users fill other information first, ...
user avatar
  • 177
6 votes
1 answer
12k views

Discovering a vulnerable service on a machine

I am trying to get access to one of the machines in my lab. it has 2 tcp ports that I am highly suspecting which are: port 25 tcp port 111 tcp For port 25, it is supposed to be running SMTP, however,...
user avatar
14 votes
4 answers
11k views

Is username enumeration practical when the username is an email address?

From what I understand it is bad security practice to display informative failed login messages like: The email you entered does not exist Instead of Incorrect email/password combination ...
user avatar
  • 8,145
8 votes
3 answers
3k views

How important is CAPTCHA on registration pages?

I am working on a site and I would like to add CAPTCHA to the user registration page to prevent user name enumeration. I am working with a front end developer who feels pretty strongly that we should ...
user avatar
  • 8,145
1 vote
1 answer
737 views

Network enumeration protection [closed]

I was reading about DNS security, and readed about Zone Transfer and how can be used to retrieve host information of a network, so not allowing Zone Tranfer from external sources will be the solution ...
user avatar
  • 359
6 votes
1 answer
7k views

How can I misuse the information of DCE service enumeration?

Nessus reports almost on any Windows machine "DCE service enumaration". With the metasploit module tcp_dcerpc_auditor I get the following information: 192.168.1.23 - UUID 99fcfec4-5260-101b-bbcb-...
user avatar
4 votes
3 answers
3k views

Techniques for fingerprinting a web based content management system (CMS)

Let's say we have a random basic blog or informational website: just some pages with information, a sidebar with an overview of the archives, the normal stuff. We know of this website that it's built ...
user avatar